max/nix-super
1
0
Fork 0
mirror of https://github.com/privatevoid-net/nix-super.git synced 2024-11-22 14:06:16 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions
No description
2422 commits 7 branches 0 tags 64 MiB
C++ 75.7%
Shell 10.7%
Nix 7.2%
Meson 1.9%
Makefile 1%
Other 3.5%
Find a file
Eelco Dolstra b2027f70d9 * Fix a huuuuge security hole in the Nix daemon. It didn't check that 
derivations added to the store by clients have "correct" output
  paths (meaning that the output paths are computed by hashing the
  derivation according to a certain algorithm).  This means that a
  malicious user could craft a special .drv file to build *any*
  desired path in the store with any desired contents (so long as the
  path doesn't already exist).  Then the attacker just needs to wait
  for a victim to come along and install the compromised path.

  For instance, if Alice (the attacker) knows that the latest Firefox
  derivation in Nixpkgs produces the path

    /nix/store/1a5nyfd4ajxbyy97r1fslhgrv70gj8a7-firefox-5.0.1

  then (provided this path doesn't already exist) she can craft a .drv
  file that creates that path (i.e., has it as one of its outputs),
  add it to the store using "nix-store --add", and build it with
  "nix-store -r".  So the fake .drv could write a Trojan to the
  Firefox path.  Then, if user Bob (the victim) comes along and does

    $ nix-env -i firefox
    $ firefox

  he executes the Trojan injected by Alice.

  The fix is to have the Nix daemon verify that derivation outputs are
  correct (in addValidPath()).  This required some refactoring to move
  the hash computation code to libstore.
2011-07-20 18:10:47 +00:00
corepkgs * nix-push: no need to compute the NAR hash, since the Nix database 2010-11-17 12:51:54 +00:00
doc * Allow a default value in attribute selection by writing 2011-07-13 12:19:57 +00:00
externals * Propagate the CC setting. 2011-02-05 16:40:15 +00:00
misc * Allow a default value in attribute selection by writing 2011-07-13 12:19:57 +00:00
scripts * Create a symlink to /nix/var/nix/manifests in /nix/var/nix/gcroots 2011-07-20 11:47:00 +00:00
src * Fix a huuuuge security hole in the Nix daemon. It didn't check that 2011-07-20 18:10:47 +00:00
tests * Added a test that make sure that users cannot register 2011-07-20 12:15:40 +00:00
.gitignore Add `.gitignore'. 2010-02-10 15:55:46 +00:00
AUTHORS * Put something in here. 2004-11-07 20:30:02 +00:00
bootstrap.sh * Use SQLite 3.7.0's write-ahead logging (WAL mode). This is a lot 2010-08-04 17:35:59 +00:00
ChangeLog * Autoconf / Automake configuration and building. 2003-04-04 16:14:56 +00:00
configure.ac * Show the default for --with-store-dir (Nix/211). 2011-07-13 15:57:44 +00:00
COPYING * Change this to LGPL to keep the government happy. 2006-04-25 16:41:06 +00:00
INSTALL * Autoconf / Automake configuration and building. 2003-04-04 16:14:56 +00:00
Makefile.am * Install config.h. 2010-10-26 10:47:02 +00:00
nix.conf.example * Document --cores in the manual. 2010-08-17 07:22:05 +00:00
nix.spec.in * Urgh. 2008-11-20 16:42:52 +00:00
README * Install documentation in $(docdir) (i.e. share/doc/nix). 2008-11-19 13:19:09 +00:00
release.nix 2011-04-11 10:23:15 +00:00
substitute.mk * configure: detect whether DBD::SQLite is present. If necessary the 2011-04-11 10:13:53 +00:00
version * Bump the version number. 2010-08-17 15:39:35 +00:00

README 

Nix is a purely functional package manager.  For installation and
usage instructions, please read the manual, which can be found in
`docs/manual/manual.html', and additionally at the Nix website at
<http://nixos.org/>.


Acknowledgments

This product includes software developed by the OpenSSL Project for
use in the OpenSSL Toolkit (http://www.OpenSSL.org/).